diff --git a/package.json b/package.json
index 2ef8492..a0c344f 100644
--- a/package.json
+++ b/package.json
@@ -65,6 +65,7 @@
     "typescript": "5.4.5",
     "universal-base64url": "1.1.0",
     "unocss": "0.59.3",
+    "user-attachments": "1.1.1",
     "vite": "5.2.9",
     "vite-plugin-monkey": "3.5.2",
     "vue": "3.4.23",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 0de1a12..4116056 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -140,6 +140,9 @@ importers:
       unocss:
         specifier: 0.59.3
         version: 0.59.3(postcss@8.4.38)(rollup@4.13.0)(vite@5.2.9(@types/node@20.12.7)(sass@1.75.0)(terser@5.26.0))
+      user-attachments:
+        specifier: 1.1.1
+        version: 1.1.1
       vite:
         specifier: 5.2.9
         version: 5.2.9(@types/node@20.12.7)(sass@1.75.0)(terser@5.26.0)
@@ -1376,26 +1379,31 @@ packages:
     resolution: {integrity: sha512-Iu0Kno1vrD7zHQDxOmvweqLkAzjxEVqNhUIXBsZ8hu8Oak7/5VTPrxOEZXYC1nmrBVJp0ZcL2E7lSuuOVaE3+w==}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-arm64-musl@4.13.0':
     resolution: {integrity: sha512-C31QrW47llgVyrRjIwiOwsHFcaIwmkKi3PCroQY5aVq4H0A5v/vVVAtFsI1nfBngtoRpeREvZOkIhmRwUKkAdw==}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-linux-riscv64-gnu@4.13.0':
     resolution: {integrity: sha512-Oq90dtMHvthFOPMl7pt7KmxzX7E71AfyIhh+cPhLY9oko97Zf2C9tt/XJD4RgxhaGeAraAXDtqxvKE1y/j35lA==}
     cpu: [riscv64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-x64-gnu@4.13.0':
     resolution: {integrity: sha512-yUD/8wMffnTKuiIsl6xU+4IA8UNhQ/f1sAnQebmE/lyQ8abjsVyDkyRkWop0kdMhKMprpNIhPmYlCxgHrPoXoA==}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@rollup/rollup-linux-x64-musl@4.13.0':
     resolution: {integrity: sha512-9RyNqoFNdF0vu/qqX63fKotBh43fJQeYC98hCaf89DYQpv+xu0D8QFSOS0biA7cGuqJFOc1bJ+m2rhhsKcw1hw==}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@rollup/rollup-win32-arm64-msvc@4.13.0':
     resolution: {integrity: sha512-46ue8ymtm/5PUU6pCvjlic0z82qWkxv54GTJZgHrQUuZnVH+tvvSP0LsozIDsCBFO4VjJ13N68wqrKSeScUKdA==}
@@ -3202,6 +3210,9 @@ packages:
   uri-js@4.4.1:
     resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
 
+  user-attachments@1.1.1:
+    resolution: {integrity: sha512-bb39ap8OFx+9TuI5LqhzqSdxeIliMDIjEP7LOREPATRpvk+W9KBFyRCUYXOITds5MIHSRFkf3o26On6+qR9xWg==}
+
   util-deprecate@1.0.2:
     resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
 
@@ -6727,6 +6738,8 @@ snapshots:
     dependencies:
       punycode: 2.3.1
 
+  user-attachments@1.1.1: {}
+
   util-deprecate@1.0.2: {}
 
   vdirs@0.1.8(vue@3.4.23(typescript@5.4.5)):
diff --git a/src/components/BuildShareDlg.vue b/src/components/BuildShareDlg.vue
index fa91386..bd439ba 100644
--- a/src/components/BuildShareDlg.vue
+++ b/src/components/BuildShareDlg.vue
@@ -1,5 +1,5 @@
 <script setup lang="tsx">
-import { uploadPoliciesAssets } from '@/utils/github';
+import { uploadAsset } from '@/utils/github';
 import { copy } from '@/utils/others';
 import { useTask } from '@/utils/task';
 import { useDebounceFn } from '@vueuse/core';
@@ -51,7 +51,7 @@ const copyLink = () => {
 
 const buildShare = useTask(async () => {
   const data = JSON5.parse(text.value);
-  const asset = await uploadPoliciesAssets(
+  const asset = await uploadAsset(
     new TextEncoder().encode(
       JSON5.stringify({
         data,
@@ -60,7 +60,6 @@ const buildShare = useTask(async () => {
       }),
     ),
     'file.txt',
-    'text/plain',
   );
   const link = location.origin + router.resolve(`/s/${asset.id}`).href;
   shareLink.value = link;
diff --git a/src/utils/export.ts b/src/utils/export.ts
index 4b556c6..d3e7463 100644
--- a/src/utils/export.ts
+++ b/src/utils/export.ts
@@ -1,7 +1,7 @@
 import { saveAs } from 'file-saver';
 import JSZip from 'jszip';
 import pLimit from 'p-limit';
-import { uploadPoliciesAssets } from './github';
+import { uploadAsset } from './github';
 import { delay } from './others';
 import {
   githubJpgStorage,
@@ -81,10 +81,9 @@ export const batchZipDownloadZip = async (snapshots: Snapshot[]) => {
 export const exportSnapshotAsJpgUrl = async (snapshot: Snapshot) => {
   return (
     githubJpgStorage[snapshot.id] ??
-    uploadPoliciesAssets(
+    uploadAsset(
       await snapshotAsJpg(snapshot).then((r) => r.arrayBuffer()),
       'file.jpg',
-      'image/jpeg',
     ).then((r) => {
       githubJpgStorage[snapshot.id] = r.href;
       return r.href;
@@ -95,10 +94,9 @@ export const exportSnapshotAsJpgUrl = async (snapshot: Snapshot) => {
 export const exportSnapshotAsImportId = async (snapshot: Snapshot) => {
   return (
     importStorage[snapshot.id] ||
-    uploadPoliciesAssets(
+    uploadAsset(
       await snapshotAsZip(snapshot).then((r) => r.arrayBuffer()),
       'file.zip',
-      'application/x-zip-compressed',
     ).then((r) => {
       importStorage[snapshot.id] = r.id;
       urlStorage[r.id] = snapshot.id;
diff --git a/src/utils/github.ts b/src/utils/github.ts
index 1bf4129..3d1b3a3 100644
--- a/src/utils/github.ts
+++ b/src/utils/github.ts
@@ -1,122 +1,22 @@
 import { enhanceFetch } from './fetch';
-import { obj2form } from './others';
 import store from './store';
+import { uploadPoliciesAssets } from 'user-attachments';
+import type { PoliciesAsset } from 'user-attachments';
 
-const authenticityTokenPageUrl = `https://github.com/gkd-kit/inspect/issues/new`;
-const repository_id = `661952005`;
-const commonHeaders = {
-  origin: `https://github.com`,
-  referer: authenticityTokenPageUrl,
-};
-
-const getCsrfToken = async () => {
-  const csrfSelector = `[data-upload-policy-url="/upload/policies/assets"] input.js-data-upload-policy-url-csrf`;
-  const resp = await enhanceFetch(authenticityTokenPageUrl);
-  const responseDoc = new DOMParser().parseFromString(
-    await resp.text(),
-    'text/html',
-  );
-  const csrfToken = responseDoc
-    .querySelector(csrfSelector)
-    ?.getAttribute(`value`);
-  return csrfToken;
-};
-
-type S3Form = {
-  key: string;
-  acl: string;
-  policy: string;
-  'X-Amz-Algorithm': string;
-  'X-Amz-Credential': string;
-  'X-Amz-Date': string;
-  'X-Amz-Signature': string;
-  'Content-Type': string;
-  'Cache-Control': string;
-  'x-amz-meta-Surrogate-Control': string;
-};
-export type GithubPoliciesAsset = {
-  id: number;
-  name: string;
-  size: number;
-  content_type: string;
-  original_name: string;
-  href: string;
-};
-
-type UploadPoliciesAssetsRsonpse = {
-  upload_url: string;
-  header: object;
-  asset: GithubPoliciesAsset;
-  form: S3Form;
-  same_origin: boolean;
-  asset_upload_url: string;
-  upload_authenticity_token: string;
-  asset_upload_authenticity_token: string;
-};
+export type GithubPoliciesAsset = PoliciesAsset;
 
-export const uploadPoliciesAssets = async (
+export const uploadAsset = async (
   bf: ArrayBuffer,
   name: string,
-  content_type: string,
-): Promise<GithubPoliciesAsset> => {
-  const authenticity_token = await getCsrfToken();
-  if (!authenticity_token) {
-    store.githubErrorDlgVisible = true;
-    throw new Error(`failed get csrfToken`);
-  }
-
-  const policiesResp: UploadPoliciesAssetsRsonpse = await enhanceFetch(
-    `https://github.com/upload/policies/assets`,
-    {
-      method: `POST`,
-      body: obj2form({
-        authenticity_token,
-        content_type,
-        name,
-        size: bf.byteLength,
-        repository_id,
-      }),
-      headers: commonHeaders,
-    },
-  ).then((r) => {
-    if (!r.ok) {
-      throw new Error(`failed upload policies assets`);
+): Promise<PoliciesAsset> => {
+  return await uploadPoliciesAssets({
+    file: new File([bf], name),
+    url: 'https://github.com/gkd-kit/inspect/issues/1',
+    fetch: enhanceFetch,
+  }).catch((e) => {
+    if (e instanceof Error && e.message === 'not found authenticity_token') {
+      store.githubErrorDlgVisible = true;
     }
-    return r.json();
-  });
-
-  // violentmonkey success
-  // tampermonkey failed https://github.com/Tampermonkey/tampermonkey/issues/1783
-  // use fetch is also work, but console.error cors and can not get response
-  const s3Resp = await enhanceFetch(policiesResp.upload_url, {
-    method: `POST`,
-    body: obj2form(policiesResp.form, {
-      file: new File([bf], name, { type: content_type }),
-    }),
-    headers: commonHeaders,
+    throw e;
   });
-  if (!s3Resp.ok) {
-    throw new Error(`upload s3 failed`);
-  }
-
-  const assetsResp = await enhanceFetch(
-    new URL(policiesResp.asset_upload_url, `https://github.com/`).href,
-    {
-      method: `PUT`,
-      body: obj2form({
-        authenticity_token: policiesResp.asset_upload_authenticity_token,
-      }),
-      headers: {
-        ...commonHeaders,
-        // api must add `Accept` request headers
-        Accept: `application/json`,
-      },
-    },
-  );
-
-  if (assetsResp.status != 200) {
-    throw new Error(`failed check authenticity upload`);
-  }
-
-  return policiesResp.asset;
 };